feat: Google Drive checks follow the design's rows, copy and states

Merged
EV
4d ago
+1130-183

Description

Eighth backend PR for the connector checks redesign, stacked on #16193. Google Drive follows the design's rows, copy and states. This PR also brings the partial Find.

Framework: partial results

  • A check can return CheckOutput(partial=True). A Find that found only some selected items is then incomplete, with partial: true, and says what is missing in its description.
  • The checks after it still run, on what it found. This is the design's rule: "Incomplete when only some are found, and the other checks run on the ones found."

Google Drive

  • Rows:
    • The three user listings share "List Workspace users": the indexing check, the user count and the group-sync listing.
    • The two shared-drive steps share "List shared drives".
    • So the 19 checks make the design's 16 rows.
    • Dependencies follow the design's run order.
  • Copy:
    • Every failure gives the design's line and description, with what the credential kind needs: reconnect for OAuth, or the domain-wide delegation scopes for a service account.
    • Passing checks give what they found, e.g. "Acting as {admin}", "{n} Workspace users found", "All {n} selected drives found", "Read {n} sample files", "Members of {group} readable".
  • Partial finds: Find selected drives, Find selected folders and Find My Drive users.
    • Some missing: Incomplete, e.g. "1 of 2 selected drives not found".
    • None found: Failed ("No selected drive found").
    • Not among the first 5,000 users: Incomplete (inconclusive).
  • Honest passes. Six checks passed while testing nothing.
    • With nothing to test, they are now Incomplete or Skipped: no file, Google Doc, folder or shared drive.
    • A passing sample carries a caveat that the rest was not tested.

Fixes from the design's review

  • Bad key. A deleted or wrong service-account key (Invalid JWT Signature, invalid_client) reads as "Google no longer accepts the account" (rejected), not as a domain-wide delegation problem.
  • Admin SDK errors. Admin SDK calls inside a Drive probe (the user list behind the Find checks, the admin lookup behind Read drive members) map their errors as the Admin SDK. A disabled Admin SDK API no longer reads as "The Google Drive API is turned off".
  • 404s. A 404 is a clear failure (error_kind: invalid) instead of "Unexpected Google response".
  • Rate limits. They raise RateLimitedValidationError, which stops the run.
  • OAuth settings. The check no longer says "clear these settings": the form hides those fields for OAuth.
  • Error Details. GoogleDriveHttpError is a SourceApiError, so Error Details show the request URL and Google's error body (redacted as in #16160).

Not in this PR: the key and OAuth expiry lines ("Certificate valid until …") from the design's "values" section.

How Has This Been Tested?

  • New unit tests:
    • the partial result lets dependents run;
    • Drive (test_google_drive_check_row_text.py): the sign-in line, the bad key, the Admin SDK error in a Drive probe, a 404, and the 16 rows.
  • Existing Drive tests updated to the new states, with new tests for partial and empty finds and for folder permissions.
  • Connector and EE unit tests: 4303 passed. The 93 capability-check external dependency tests pass on a scratch DB. ty is clean.
  • No local Google credentials, so no live run.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by cubic

Rewrites the Google Drive connector checks to follow the design's rows, copy, and states, and adds a partial-result concept to the checks framework.

  • A check can return CheckOutput(partial=True): a Find that located only some selected items is INCOMPLETE, says what is missing, and its dependents still run on what it found.
  • The 19 Google Drive checks now make the design's 16 rows (the three user listings share "List Workspace users", the two shared-drive steps share "List shared drives"); failures and passing checks carry the design's copy.
  • Partial finds (selected drives, folders, My Drive users) are INCOMPLETE when some items are missing and FAILED when none are found.
  • Checks that previously passed without testing anything now report INCOMPLETE or SKIPPED, and sampled checks note that the rest was not tested.

Fixes from the design's review

  • A deleted or wrong service-account key reads as "Google no longer accepts the account", not as a delegation problem.
  • Admin SDK errors inside Drive probes are attributed to the Admin SDK, so a disabled Admin SDK API no longer reads as the Drive API being off.
  • 404s are clear failures (invalid); rate limits raise RateLimitedValidationError, stop the run, and show the status Google sent.
  • GoogleDriveHttpError is a SourceApiError, so Error Details show the request and Google's error body.
  • The selected-user and My Drive checks depend on sign-in directly, so a failed sign-in skips them even when "List Workspace users" does not apply.
  • The design's key and OAuth expiry lines are not included in this PR.

Summary by CodeRabbit

  • New Features
    • Google Drive connection checks distinguish partial verification from complete success or failure, with clearer summaries, findings, and advisories.
    • Checks that depend on partial results can continue against the confirmed scope.
    • Results indicate when only part of the selected scope was verified.
  • Bug Fixes
    • Improved diagnosis of Google Drive access issues, including invalid credentials, missing or inaccessible targets, and API errors.
    • Checks distinguish unavailable samples from failures and skip folder-permission checks when no folders are in scope.